Overview of Cloud Run threats

Security Command Center performs runtime and control plane monitoring of Cloud Run resources. For recommended responses to these threats, see Respond to Cloud Run threat findings.

Runtime finding types

The following runtime detections are available with Cloud Run Threat Detection:

Execution: Added Malicious Binary Executed

Execution: Added Malicious Library Loaded

Execution: Built in Malicious Binary Executed

Execution: Container Escape

Execution: Kubernetes Attack Tool Execution

Execution: Local Reconnaissance Tool Execution

Execution: Malicious Python executed

Execution: Modified Malicious Binary Executed

Execution: Modified Malicious Library Loaded

Malicious Script Executed

Malicious URL Observed

Reverse Shell

Unexpected Child Shell

Control plane finding types

The following control plane detections are available with Event Threat Detection:

Execution: Cryptomining Docker Image

Impact: Cryptomining Commands

Privilege Escalation: Default Compute Engine Service Account SetIAMPolicy